Decide user experience first. it requires UX work, therefore it is not an on call ticket.

@JWuyts-WMF and @creynolds will come up with the requirements and Product will prioritize
cc. @Cpetrillo

I think UX, straightforward, should be:

• IF user requests dashboard URL https://dashboard.enterprise.wikimedia.com/dashboard
  • IF token is expired, redirect to login page. Show message on login page 'Your session has expired. Please sign in.'
  • ELSE: load dashboard, refresh dashboard numbers

acceptance criteria:

• As a user, when I load the dashboard, the dashboard always shows a correct reflection of the # of calls I have left this month.
• As a user, when I am redirected to the login page, I know why I was redirected and need to log back in.

Question if 'polling' is used on session, otherwise a stale window can stay "logged in" and without a refresh user wouldn't know. Hitting Cognito's /oauth2/userInfo endpoint at an interval like 60sec and if response.status === 401 redirect to /. At that point we can display a "Your session has expired. Please log in" 'modal' box (not a modal but the alert box I forget the name of).

RE: the refreshing of user telemetry/stats... Is that not a different ticket as it's unrelated. But that would be a longer interval poll with some caching involved there; to discuss in the/a ticket for that issue.

@creynolds @JWuyts-WMF let me nknow when the refinement of this ticket is done so I can send it to Product for the triage

Updated OP; ready @JArguello-WMF

The added task about updating quota numbers is now created as T404929

Related???

Logout Race Condition - #4 in list of Security review in repo /dashboard/-/issues/15
File: src/store/useAuth.ts:52-58

const logout = async () => {
  auth.authorized = initialValue.authorized;  // Cleared before API call
  router.push("/");
  const res = await axios.post("/token-revoke", { refresh_token: auth.refresh_token });

The state is cleared and router navigates away before the token revocation API call completes. If revocation fails, the token remains valid server-side.

Fix: Move state clearing to after successful API response.

I don't believe that's related @creynolds. logout() is probably used when a user clicks the logout/signout button, but this issue occurs also the user does nothing and just lets their credentials expire.